Know your component's class under the EU CRA and what each OEM gets from you.

Self-assessment depends on the component's class. Default-class components such as sensors or I/O modules may use internal control, module A (Art. 32(1)). For class I, such as a security microcontroller, module A requires harmonised standards, common specifications or a certification scheme at assurance level substantial or higher, applied in full; otherwise module B plus C, or module H (Art. 32(2)). Class II parts such as tamper-resistant microcontrollers go through a third-party procedure (Art. 32(3)).

A drive's class follows the drive's own core functionality. Integrating an Annex III product such as a security microcontroller does not on its own bring the host product under the procedures in Art. 32(2) and (3), as the second sentence of Art. 7(1) EU CRA states; the EU Commission guidance runs the same logic for a router with a firewall component (chapter 6, Example 63). The chip itself is classified by its own manufacturer, under Annex III, class I, point 14.

Actively exploited vulnerabilities and severe incidents are the two triggers for reporting under Art. 14 of the Cyber Resilience Act, and the reports go to the coordinating CSIRT and ENISA at once through the single reporting platform. As of 11 September 2026, each one needs an early warning within 24 hours of becoming aware, a notification within 72 hours and a final report no later than 14 days after a fix is available (Art. 14(2)). Components already on the market are covered as well (Art. 69(3)). Other vulnerabilities stay in the supplier's own Annex I, Part II process.

Spare parts are exempt under Art. 2(6) EU CRA when they replace identical components and are made to the same specifications. The EU Commission guidance (chapter 4) reads identical in terms of security-relevant properties: a new chipset with the same protocols and security mechanisms can still qualify (Example 38), while a different cryptographic implementation or secure-boot mechanism cannot (Example 37). The exemption also requires the part to be demonstrably supplied to repair an existing product, for instance with that product named in the order. A successor type sold through the regular channel is a new product.

An industrial component needs a support period of at least five years under Art. 13(8) EU CRA, and longer if it is expected to stay in use longer. To estimate that use time, the manufacturer weighs reasonable user expectations and the nature of the product, and can also look at comparable products from other makers and at how long the operating environment stays available. The reasoning goes into the Annex VII technical file. The Commission can set minimum periods for specific product categories by delegated act.

An IEC 62443-4-2 certificate attests that an automation component meets the technical security requirements of that standard, and the OEM can file it with the component's security documentation. Presumption of conformity with the EU CRA comes from harmonised standards whose references are published in the Official Journal of the EU (Art. 27(1)). Towards the OEM, the EU declaration of conformity remains the proof.